Emotive terms such as “cyber attack” and “cyber-terrorism” are always certain to generate plenty of media excitement, with science-fiction visions of malevolent hackers creating vicious computer viruses to rampage through cyberspace, doing unseen and untold damage to the infrastructures that support our way of life. However, while the reality of IT security is far more mundane than such science-fiction ideas, the threat to a network from malicious attack remains real and the consequences just as frightening. Every business is dependent upon information technology, which brings with it inevitable vulnerability.

Dark rumours of underground hacker networks and conferences give rise to the belief in a vast and growing number of aggressive, deliberately destructive hackers. Significantly, the methods these hackers adopt to gain unauthorised access to corporate resources are now also extending to embrace telecommunications systems.

The terrorist threat

The hacker phenomenon has a serious and far-reaching influence. Were communications on two continents ever disrupted by moving telecommunications satellites? Have computing resources belonging to government agencies ever been hacked? Have environmental controls in a shopping centre ever been altered via modem? The answer to all of these questions is yes. But, unlike other crime groups who receive high profile coverage in the media, the individuals responsible for these incidents are rarely caught.

As if that is not enough, unauthorised use of telecommunications facilities is the preferred methodology for people who sympathise or support terrorist organisations, and want their activities to remain invisible.

The French authorities studying the Madrid train bombings in March 2004, for example, are investigating whether the bombers hacked into the telephone exchange of a bank near Paris as they were planning their attack. The telephone calls involved were made by phreaking - a practice similar to hacking that bypasses the charging system.

Combating telephony fraud

The PBX is among the most susceptible areas to telecommunications fraud. Typical methods of fraudulent abuse involve the misuse of common PBX functions such as DISA (Direct Inward System Access), looping, call forwarding, voicemail and auto attendant features.

Another area popular for frequent fraudulent exploitation is the maintenance port of PBXs. Hackers often use the dial-up modem attached to such ports to assist in remote maintenance activities. When a PBX is linked to an organisation’s IT network – as is increasingly the case with call centres, for instance – a poorly protected maintenance port can offer hackers an open and undefended “back door” into such critical assets as customer databases and business applications.

When things go wrong

It is clearly important to balance the cost of securing your voice infrastructure from attack against the cost of doing nothing. The consequences from inaction can include:

Adverse publicity, damage to reputation and loss of customer confidence

Litigation and consequential financial loss

Loss of service and inability to dispense contractual obligations

Regulatory fines or increased regulatory supervision

The threat from within

As is the trend with hacking data networks, the threat to PBXs comes primarily from within. For example, an employee, a contractor, or even a cleaner could forward an extension in a seldom-used meeting room to an overseas number and make international calls by calling a local rate number in the office.

Spotlight

35 percent of employees would sell information on company patents, financial records and customer credit card details if the price was right. This illustrates the growing importance for organizations to deploy data loss prevention strategies.

Sun Tzu's writings have been studied throughout the ages by professional militaries and can used to not only answer the question of whether or not we are in a cyberwar, but how one can fight a cyber-battle.

Infosec consultant Paul Moore came up with a working solution to thwart a type of behavioral profiling. The result is a Chrome extension called Keyboard Privacy, which prevents profiling of users by the way they type by randomizing the rate at which characters reach the DOM.

There is still way too much apathy when it comes to data-centric security. Given the sensitive data the OPM was tasked with protecting, it should have had state-of-the-art data protection, but instead it has become the poster child for IT security neglect.